Chapter 5. Configuring a shared VPC for Red Hat OpenShift Service on AWS clusters

Procedure

1. Create or modify a VPC to your specifications in the VPC section of the AWS console. Make sure you have selected the correct region.

2. Create the Route 53 role.

   Note

   You must create the Route 53 role in the same account where you plan to create the Amazon Route 53 hosted zones (which are created in Step 3). For example, if you want to create the hosted zones in the centrally-managed VPC account, you must create the Route 53 role in the VPC Owner account. If you want to create the hosted zones in the workload account, you must create the Route 53 role in the Cluster Creator account.

   1. Create a custom trust policy file that grants permission to assume roles:

      $ cat <<EOF > /tmp/route53-role.json
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::<Account-ID>:root"  

      1

      
                  },
                  "Action": "sts:AssumeRole"
              }
          ]
      }
      EOF

      Copy to Clipboard Toggle word wrap

      1

      The trust policy principals may be scoped down to the ingress Operator role and installer account role rather than root.

   2. Create the IAM role for the AWS managed policy ROSASharedVPCRoute53Policy.

      $ aws iam create-role --role-name <role_name> \  

      1

      
          --assume-role-policy-document file:///tmp/route53-role.json

      Copy to Clipboard Toggle word wrap

      1

      Replace <role_name> with the name of the role you want to create.

   3. Attach the AWS managed policy ROSASharedVPCRoute53Policy to allow for necessary shared VPC permissions.

      $ aws iam attach-role-policy --role-name <role_name> \  

      1

      
      --policy-arn arn:aws:iam::aws:policy/ROSASharedVPCRoute53Policy

      Copy to Clipboard Toggle word wrap

      1

      Replace <role_name> with the name of the role you created.

3. Create the VPC endpoint role.

   1. Create a custom trust policy file that grants permission to assume roles:

      $ cat <<EOF > /tmp/shared-vpc-role.json
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::<Account-ID>:root"  

      1

      
                  },
                  "Action": "sts:AssumeRole"
              }
          ]
      }
      EOF

      Copy to Clipboard Toggle word wrap

      1

      The trust policy principals may be scoped down to the ingress Operator role and installer account role rather than root.

   2. Create the IAM role for the AWS managed policy ROSASharedVPCEndpointPolicy:

      $ aws iam create-role --role-name <role_name> \  

      1

      
          --assume-role-policy-document file:///tmp/vpce-role.json

      Copy to Clipboard Toggle word wrap

      1

      Replace <role_name> with the name of the role you want to create.

   3. Attach the AWS managed policy ROSASharedVPCEndpointPolicy to allow for necessary shared VPC permissions.

      $ aws iam attach-role-policy --role-name <role_name> \  

      1

      
      --policy-arn arn:aws:iam::aws:policy/ROSASharedVPCEndpointPolicy

      Copy to Clipboard Toggle word wrap

      1

      Replace <role_name> with the name of the role you created.

4. Provide the Route 53 role ARN and the VPC endpoint role ARN to the Cluster Creator to continue configuration.

Procedure

1. Reserve an openshiftapps.com DNS domain with the following command:

   $ rosa create dns-domain --hosted-cp

   Copy to Clipboard Toggle word wrap

   The command creates a reserved openshiftapps.com DNS domain.

   I: DNS domain '14eo.p3.openshiftapps.com' has been created.
   I: To view all DNS domains, run 'rosa list dns-domains'

   Copy to Clipboard Toggle word wrap

2. Create an OIDC configuration.

   Review this article for more information on the OIDC configuration process. The following command produces the OIDC configuration ID that you need:

   $ rosa create oidc-config

   Copy to Clipboard Toggle word wrap

   You receive confirmation that the command created an OIDC configuration:

   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 25tu67hq45rto1am3slpf5lq6jargg

   Copy to Clipboard Toggle word wrap

3. Create the account roles by entering the following command:

   $ rosa create account-roles
       --route53-role-arn <Created_Route_53_Role_Arn> 

   1

   
       --vpc-endpoint-role-arn <Created_VPC_Endpoint_Role_Arn> 

   2

   
       --prefix <user_defined_account_role_prefix> 

   3

   
       --hosted-cp

   Copy to Clipboard Toggle word wrap

   1

   Provide the ARN for the Route 53 role that the VPC Owner created.

   2

   Provide the ARN for the VPC endpoint role that the VPC Owner created.

   3

   Provide a prefix for the Operator roles.

4. Create the Operator roles by entering the following command:

   $ rosa create operator-roles --oidc-config-id <oidc-config-ID> 

   1

   
       --installer-role-arn <Installer_Role> 

   2

   
       --route53-role-arn <Created_Route_53_Role_Arn> 

   3

   
       --vpc-endpoint-role-arn <Created_VPC_Endpoint_Role_Arn> 

   4

   
       --prefix <operator-prefix> 

   5

   
       --hosted-cp

   Copy to Clipboard Toggle word wrap

   1

   Provide the OIDC configuration ID that you created in the previous step.

   2

   Provide your installer ARN that was created as part of the rosa create account-roles process.

   3

   Provide the ARN for the Route 53 role that the VPC Owner created.

   4

   Provide the ARN for the VPC endpoint role that the VPC Owner created.

   5

   Provide a prefix for the Operator roles.

   Note

   The Installer account role and the shared VPC roles must have a one-to-one relationship. If you want to create multiple shared VPC roles, you should create one set of account roles per shared VPC role.

5. After you create the Operator roles, share your Ingress Operator Cloud Credentials role’s ARN, your Installer role’s ARN, and your Control plane Operator Cloud Credentials role’s ARN with the VPC Owner to continue configuration.

   The shared information resembles these examples:

   • my-rosa-cluster.14eo.p1.openshiftapps.com
   • arn:aws:iam::111122223333:role/ManagedOpenShift-Installer-Role
   • arn:aws:iam::111122223333:role/my-rosa-cluster-openshift-ingress-operator-cloud-credentials
   • arn:aws:iam::111122223333:role/my-rosa-cluster-control-plane-operator

Procedure

1. In the Resource Access Manager of the AWS console, create a resource share that shares the previously created VPC’s public and private subnets with the Cluster Creator’s AWS account ID.

2. Update the Route 53 role and add the Installer and Ingress Operator Cloud Credentials roles to the principal section of the trust policy.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
   	  "Sid": "Statement1",
   	  "Effect": "Allow",
   	  "Principal": {
   	  	"AWS": [
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-ingress-operator-cloud-credentials",
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-hcp-Installer-Role",
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-control-plane-operator-cloud-credentials"
           ]
   	  },
   	  "Action": "sts:AssumeRole"
   	}
     ]
   }

   Copy to Clipboard Toggle word wrap

3. Update the VPC endpoint role and add the Installer and Ingress Operator Cloud Credentials roles to the principal section of the trust policy.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
   	  "Sid": "Statement1",
   	  "Effect": "Allow",
   	  "Principal": {
   	  	"AWS": [
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-hcp-Installer-Role",
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-control-plane-operator-cloud-credentials"
           ]
   	  },
   	  "Action": "sts:AssumeRole"
   	}
     ]
   }

   Copy to Clipboard Toggle word wrap
4. Create a private hosted zone in the Route 53 section of the AWS console. In the hosted zone configuration, the domain name is rosa.<cluster-name>.<base-domain>. The private hosted zone must be associated with the network owner’s VPC.
5. Create a local hosted zone in the Route 53 section of the AWS console. In the hosted zone configuration, the domain name is <cluster-name>.hypershift.local. The local hosted zone must be associated with the network owner’s VPC.

6. After the hosted zones are created and associated with the network owner’s VPC, provide the following to the Cluster Creator to continue configuration:

   • Hosted zone IDs
   • AWS region
   • Subnet IDs